'Shimmers' Target Chip-Based Cards

According to multiple reports, there is a new form of card skimming called "shimming” that targets chip-based credit and debit cards. Although shimming fraud is rare, it is important to be aware of the risks and the steps you can take to minimize them.

A shimmer, when inserted into an ATM card-acceptance slot or point-of-sale device, sits between a card’s EMV chip and the device’s chip reader, allowing criminals to read the chip and steal card information. This new device is similar in nature to skimmers, which are illegally affixed to the slot of an ATM or point-of-sale system and secretly remove valuable card information from the magnetic stripe on cards.

Data collected by shimmers cannot be used to create a new chip-based card, but could be used to duplicate a magnetic stripe card. Although the data that is typically stored on a card’s magnetic stripe is replicated inside the chip on chip-enabled cards, the chip contains an additional security components not found on a magnetic stripe.

Here are a few steps you can take to minimize the success of shimmers and skimmers:

• Use contactless payment services such as Apple Pay® or Samsung Pay®.
• If you notice resistance when entering your card into a reader, don’t accept the transaction.
• Cover the PIN pad while you enter your PIN.
• Be wary of point-of-sale systems that look out of the ordinary or tampered-with.
• Keep your wits about you when you’re at an ATM, and avoid dodgy-looking and standalone cash machines in low-lit areas, if possible.
• Stick to ATMs that are physically installed in a financial institution. Stand-alone ATMs are usually easier for thieves to hack.
• Be especially vigilant when withdrawing cash on the weekends; thieves tend to install devices when they know the financial institution won’t be open again for more than 24 hours.
• Keep a close eye on your bank statements, and dispute any unauthorized charges or withdrawals immediately.

What is Lafayette Federal doing to protect our members?

• Cancelling and reissuing cards if they are compromised.
• Frequently inspecting our ATMs for fraud devices.
• Working with appropriate agencies in the event that a device is discovered.

Source: KrebsOnSecurity